WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 101–150 of 184 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 3 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.1 High EZ SQL Reports Shortcode Widget and DB Backup Plugin elisqlreports Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 5.25.08 Fixed in 5.25.10 CVE-2025-30787 Patchstack
7.2 High Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid Plugin boldgrid-backup Remote Code Execution WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.10 - Authenticated (Admin+) Command Injection ≤ 1.16.10 CVE-2025-2257 Wordfence
8.8 High EZ SQL Reports Shortcode Widget and DB Backup Plugin elisqlreports Cross-Site Request Forgery Cross-Site Request Forgery to Remote Code Execution No login needed 4.11.13 – 5.25.08 CVE-2025-2319 Wordfence
7.1 High WordPress SQL Backup Plugin wordpress-sql-backup Cross-Site Request Forgery No login needed ≤ 3.5.2 CVE-2025-30608 Patchstack
7.2 High Database Backup and check Tables Automated With Scheduler 2024 Plugin database-backup Arbitrary File Deletion Authenticated (Administrator+) Arbitrary File Deletion ≤ 2.36 CVE-2024-13910 Wordfence
7.2 High Database Backup and check Tables Automated With Scheduler 2024 Plugin database-backup Information Disclosure Authenticated (Administrator+) Sensitive Information Exposure ≤ 2.35 CVE-2024-13911 Wordfence
4.9 Medium Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid Plugin boldgrid-backup Server-Side Request Forgery WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.8 - Authenticated (Administrator+) Server-Side Request Forgery ≤ 1.16.8 CVE-2024-13907 Wordfence
6.5 Medium EZ SQL Reports Shortcode Widget and DB Backup Plugin elisqlreports Cross-Site Scripting ≤ 5.21.35 Fixed in 5.25.08 CVE-2025-26887 Patchstack
7.2 High Migration, Backup, Staging – WPvivid Plugin wpvivid-backuprestore Arbitrary File Upload WPvivid <= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file ≤ 0.9.112 CVE-2024-13869 Wordfence
5.9 Medium 1 Click WordPress Migration Plugin – 100% FREE for a limited time Plugin 1-click-migration Information Disclosure Unauthenticated Sensitive Information Exposure via Database Backup in class-ocm-backup.php No login needed ≤ 2.2 CVE-2024-13609 Wordfence
5.3 Medium 1 Click WordPress Migration Plugin – 100% FREE for a limited time Plugin 1-click-migration Cross-Site Request Forgery Cross-Site Request Forgery to Backup Process Cancellation No login needed ≤ 2.2 CVE-2024-13555 Wordfence
4.9 Medium Keep Backup Daily Plugin keep-backup-daily Path Traversal Arbitrary File Download ≤ 2.1.0 Fixed in 2.1.1 CVE-2025-26779 Patchstack
6.1 Medium UpdraftPlus - Backup/Restore Plugin updraftplus Cross-Site Scripting Backup/Restore <= 1.24.12 - Reflected Cross-Site Scripting No login needed ≤ 1.24.12 CVE-2025-0215 Wordfence
7.5 High WP Database Backup – Unlimited Database & Files Backup by Backup for WP Plugin wp-database-backup Information Disclosure Unlimited Database & Files Backup by Backup for WP <= 7.3 - Unauthenticated Database Back-Up Exposure No login needed ≤ 7.3 CVE-2024-12330 Wordfence
4.3 Medium WPvivid Backup and Migration Plugin wpvivid-backuprestore Broken Access Control ≤ 0.9.106 Fixed in 0.9.107 CVE-2024-56273 Patchstack
8.8 High UpdraftPlus: WP Backup & Migration Plugin updraftplus PHP Object Injection Unauthenticated PHP Object Injection No login needed 1.23.8 – 1.24.11 CVE-2024-10957 Wordfence
8.8 High Backup Migration Plugin backup-backup PHP Object Injection Unauthenticated PHP Object Injection via 'recursive_unserialize_replace' No login needed ≤ 1.4.6 CVE-2024-10932 Wordfence
5.4 Medium WordPress Backup & Migration Plugin wp-migration-duplicator Broken Access Control ≤ 1.4.1 Fixed in 1.4.2 CVE-2023-45636 Patchstack
7.1 High WP SuperBackup Plugin indeed-wp-superbackup Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.3.3 Fixed in 2.4 CVE-2024-56069 Patchstack
7.4 High WP SuperBackup Plugin indeed-wp-superbackup Broken Access Control Multiple Subscriber+ Broken Access Control vulnerabilities ≤ 2.3.3 Fixed in 2.4 CVE-2024-56070 Patchstack
10.0 Critical WP SuperBackup Plugin indeed-wp-superbackup Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 2.3.3 Fixed in 2.4 CVE-2024-56064 Patchstack
7.5 High WP SuperBackup Plugin indeed-wp-superbackup PHP Object Injection Subscriber+ PHP Object Injection ≤ 2.3.3 Fixed in 2.4 CVE-2024-56068 Patchstack
7.5 High WP SuperBackup Plugin indeed-wp-superbackup Broken Access Control Unauthenticated Backup File Download No login needed ≤ 2.3.3 Fixed in 2.4 CVE-2024-56067 Patchstack
4.9 Medium Database Backup and check Tables Automated With Scheduler 2024 Plugin database-backup Path Traversal Authenticated (Admin+) Arbitrary File Read ≤ 2.32 CVE-2024-12850 Wordfence
4.3 Medium WordPress Backup & Migration Plugin wp-migration-duplicator Broken Access Control ≤ 1.4.0 Fixed in 1.4.1 CVE-2023-33928 Patchstack
9.8 Critical Super Backup & Clone - Migrate Plugin Arbitrary File Upload Migrate for WordPress <= 2.3.3 - Unauthenticated Arbitrary File Upload No login needed ≤ 2.3.3 CVE-2024-9290 Wordfence
4.3 Medium Backup Bank: WordPress Backup Plugin wp-backup-bank Broken Access Control ≤ 4.0.28 CVE-2023-28165 Patchstack
9.8 Critical WP Umbrella: Update Backup Restore & Monitoring Plugin wp-health Local File Inclusion Unauthenticated Local File Inclusion No login needed ≤ 2.17.0 CVE-2024-12209 Wordfence
7.2 High Total Upkeep Plugin boldgrid-backup Remote Code Execution Authenticated (Administrator+) Remote Code Execution via Backup Settings ≤ 1.16.6 CVE-2024-9461 Wordfence
4.9 Medium CYAN Backup Plugin cyan-backup Path Traversal Arbitrary File Download ≤ 2.5.3 Fixed in 2.5.4 CVE-2024-52390 Patchstack
8.8 High SK WP Settings Backup Plugin sk-wp-settings-backup Cross-Site Request Forgery CSRF to PHP Object Injection No login needed ≤ 1.0 CVE-2024-52415 Patchstack
9.8 Critical Backup and Staging by WP Time Capsule Plugin wp-time-capsule Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 1.22.21 CVE-2024-8856 Wordfence
8.8 High Migration, Backup, Staging – WPvivid Plugin wpvivid-backuprestore PHP Object Injection WPvivid <= 0.9.107 - Unauthenticated PHP Object Injection No login needed ≤ 0.9.107 CVE-2024-10962 Wordfence
7.5 High Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin everest-backup Information Disclosure WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.2.13 - Sensitive Invormation Disclosure via procstat Log No login needed ≤ 2.2.13 CVE-2024-10028 Wordfence
5.4 Medium Backup and Restore Plugin wp-backitup Broken Access Control ≤ 1.50 CVE-2024-43268 Patchstack
5.3 Medium Backup and Restore Plugin wp-backitup Broken Access Control Unauthenticated Broken Access Control No login needed ≤ 1.50 CVE-2024-43270 Patchstack
7.2 High All-in-One WP Migration and Backup Plugin all-in-one-wp-migration Remote Code Execution Authenticated (Administrator+) Arbitrary PHP Code Injection ≤ 7.86 CVE-2024-9162 Wordfence
7.2 High Backup and Staging by WP Time Capsule Plugin wp-time-capsule PHP Object Injection ≤ 1.22.21 Fixed in 1.22.22 CVE-2024-49684 Patchstack
5.3 Medium All-in-One WP Migration and Backup Plugin all-in-one-wp-migration Information Disclosure Unauthenticated Information Disclosure via Error Logs No login needed ≤ 7.86 CVE-2024-8852 Wordfence
7.5 High Keep Backup Daily Plugin keep-backup-daily Information Disclosure Sensitive Data Exposure No login needed ≤ 2.1.3 CVE-2024-48024 Patchstack
8.8 High Migration, Backup, Staging – WPvivid Plugin Arbitrary File Upload WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Upload ≤ 0.9.35 CVE-2020-36842 Wordfence
4.9 Medium Migration, Backup, Staging – WPvivid Plugin Information Disclosure WPvivid <= 0.9.35 - Sensitive Information Disclosure < 0.9.36 Fixed in 0.9.36 CVE-2020-36835 Wordfence
7.5 High File Manager Pro Plugin filester Remote Code Execution Unauthenticated Backup File Download and Upload No login needed ≤ 8.3.9 CVE-2024-8746 Wordfence
8.5 High Backup and Staging by WP Time Capsule Plugin wp-time-capsule SQL Injection ≤ 1.22.21 Fixed in 1.22.22 CVE-2024-48020 Patchstack
7.5 High Migration, Backup, Staging – WPvivid Plugin Information Disclosure WPvivid < 0.9.106 - Unauthenticated Sensitive Data Exposure No login needed 0.9.103 – < 0.9.106 Fixed in 0.9.106 CVE-2024-7315 WPScan
9.1 Critical Backuply – Backup, Restore, Migrate and Clone Plugin backuply SQL Injection Backup, Restore, Migrate and Clone <= 1.3.4 - Authenticated (Admin+) SQL Injection ≤ 1.3.4 CVE-2024-8669 Wordfence
4.7 Medium Snapshot Backup Plugin Cross-Site Scripting Stored XSS via CSRF No login needed ≤ 2.1.1 CVE-2024-7689 WPScan
4.3 Medium Backup and Restore Plugin wp-backitup Cross-Site Request Forgery No login needed ≤ 1.50 CVE-2024-43269 Patchstack
9.8 Critical Backup and Staging by WP Time Capsule Plugin wp-time-capsule Authentication Bypass Authentication Bypass and Privilege Escalation No login needed ≤ 1.22.20 Fixed in 1.22.21 CVE-2024-38770 Patchstack
5.3 Medium XCloner Plugin xcloner-backup-and-restore Information Disclosure Unauthenticated Full Path Disclosure No login needed ≤ 4.7.3 CVE-2024-6559 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only